Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-09 11:25:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1375277 - New safebrowsing threat type "POTENTIALLY_HARMFUL_APPLICATION" introduced by v4. r=francois

Browse Source 
As our threattype-listname conversion design, "goog-harmful-proto" is allocated
for this new threat type. This threat type is mainly for mobile.

MozReview-Commit-ID: G9GbgmHHHfp

--HG--
extra : rebase_source : 0681fcd9322b94451a86eafe57bf1ccc4b89db30
extra : intermediate-source : 28b0502d9add81beeae58a2c33f9fd5839d4d544
extra : source : 646f02f15131aa98ad37015b0a641304a3271796
This commit is contained in:
Henry Chang 2017-07-27 15:37:57 +08:00
parent bbe6006497
commit af3b11c151
15 changed files with 52 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
browser/app/profile/firefox.js
View File

@ -1698,7 +1698,7 @@ pref("extensions.formautofill.loglevel", "Warn");
pref("browser.sessionstore.restore_tabs_lazily", true);
// Enable safebrowsing v4 tables (suffixed by "-proto") update.
pref("urlclassifier.malwareTable", "goog-malware-proto,goog-unwanted-proto,test-malware-simple,test-unwanted-simple");
pref("urlclassifier.malwareTable", "goog-malware-proto,goog-unwanted-proto,test-malware-simple,test-unwanted-simple,test-harmful-simple");
pref("urlclassifier.phishTable", "goog-phish-proto,test-phish-simple");
pref("browser.suppress_first_window_animation", true);

15
browser/base/content/blockedSite.xhtml
View File

@ -89,6 +89,9 @@
case "unwantedBlocked" :
error = "unwanted";
break;
case "harmfulBlocked" :
error = "harmful";
break;
default:
return;
}
@ -122,6 +125,15 @@
el.remove();
}
if (error !== "harmful") {
el = document.getElementById("errorTitleText_harmful");
el.remove();
el = document.getElementById("errorShortDescText_harmful");
el.remove();
el = document.getElementById("errorLongDescText_harmful");
el.remove();
}
// Set sitename
document.getElementById(error + "_sitename").textContent = getHostString();
document.title = document.getElementById("errorTitleText_" + error)
@ -149,6 +161,7 @@
<h1 class="title-text" id="errorTitleText_phishing">&safeb.blocked.phishingPage.title2;</h1>
<h1 class="title-text" id="errorTitleText_malware">&safeb.blocked.malwarePage.title;</h1>
<h1 class="title-text" id="errorTitleText_unwanted">&safeb.blocked.unwantedPage.title;</h1>
<h1 class="title-text" id="errorTitleText_harmful">&safeb.blocked.harmfulPage.title;</h1>
</div>
<div id="errorLongContent">
@ -158,6 +171,7 @@
<p id="errorShortDescText_phishing">&safeb.blocked.phishingPage.shortDesc2;</p>
<p id="errorShortDescText_malware">&safeb.blocked.malwarePage.shortDesc;</p>
<p id="errorShortDescText_unwanted">&safeb.blocked.unwantedPage.shortDesc;</p>
<p id="errorShortDescText_harmful">&safeb.blocked.harmfulPage.shortDesc;</p>
</div>
<!-- Long Description -->
@ -165,6 +179,7 @@
<p id="errorLongDescText_phishing">&safeb.blocked.phishingPage.longDesc2;</p>
<p id="errorLongDescText_malware">&safeb.blocked.malwarePage.longDesc;</p>
<p id="errorLongDescText_unwanted">&safeb.blocked.unwantedPage.longDesc;</p>
<p id="errorLongDescText_harmful">&safeb.blocked.harmfulPage.longDesc;</p>
</div>
<!-- Advisory -->

2
browser/base/content/content.js
View File

@ -695,6 +695,8 @@ var ClickEventHandler = {
reason = "malware";
} else if (/e=unwantedBlocked/.test(ownerDoc.documentURI)) {
reason = "unwanted";
} else if (/e=harmfulBlocked/.test(ownerDoc.documentURI)) {
reason = "harmful";
}
let docShell = ownerDoc.defaultView.QueryInterface(Ci.nsIInterfaceRequestor)

4
browser/locales/en-US/chrome/browser/safebrowsing/phishing-afterload-warning-message.dtd
View File

@ -32,3 +32,7 @@
<!ENTITY safeb.blocked.phishingPage.shortDesc2 "This web page at <span id='phishing_sitename'/> has been reported as a deceptive site and has been blocked based on your security preferences.">
<!ENTITY safeb.blocked.phishingPage.longDesc2 "<p>Deceptive sites are designed to trick you into doing something dangerous, like installing software, or revealing your personal information, like passwords, phone numbers or credit cards.</p><p>Entering any information on this web page may result in identity theft or other fraud.</p>">
<!ENTITY safeb.blocked.harmfulPage.title "The site ahead may contain malware">
<!-- Localization note (safeb.blocked.harmfulPage.shortDesc) - Please don't translate the contents of the <span id="harmful_sitename"/> tag. It will be replaced at runtime with a domain name (e.g. www.badsite.com) -->
<!ENTITY safeb.blocked.harmfulPage.shortDesc "Firefox blocked this page because it might try to install dangerous apps that steal or delete your information (for example, photos, passwords, messages and credit cards).">
<!ENTITY safeb.blocked.harmfulPage.longDesc "">

1
browser/locales/en-US/chrome/overrides/appstrings.properties
View File

@ -31,6 +31,7 @@ externalProtocolUnknown=<Unknown>
externalProtocolChkMsg=Remember my choice for all links of this type.
externalProtocolLaunchBtn=Launch application
malwareBlocked=The site at %S has been reported as an attack site and has been blocked based on your security preferences.
harmfulBlocked=The site at %S has been reported as a potentially harmful site and has been blocked based on your security preferences.
unwantedBlocked=The site at %S has been reported as serving unwanted software and has been blocked based on your security preferences.
deceptiveBlocked=This web page at %S has been reported as a deceptive site and has been blocked based on your security preferences.
cspBlocked=This page has a content security policy that prevents it from being loaded in this way.

7
docshell/base/nsDocShell.cpp
View File

@ -5123,7 +5123,8 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI* aURI,
}
} else if (NS_ERROR_PHISHING_URI == aError ||
NS_ERROR_MALWARE_URI == aError ||
NS_ERROR_UNWANTED_URI == aError) {
NS_ERROR_UNWANTED_URI == aError ||
NS_ERROR_HARMFUL_URI == aError) {
nsAutoCString host;
aURI->GetHost(host);
CopyUTF8toUTF16(host, formatStrs[0]);
@ -5155,6 +5156,9 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI* aURI,
error = "unwantedBlocked";
bucketId = IsFrame() ? nsISecurityUITelemetry::WARNING_UNWANTED_PAGE_FRAME
: nsISecurityUITelemetry::WARNING_UNWANTED_PAGE_TOP;
} else if (NS_ERROR_HARMFUL_URI == aError) {
error = "harmfulBlocked";
// telemetry will be added in the next patch.
}
if (sendTelemetry && errorPage.EqualsIgnoreCase("blocked")) {
@ -8001,6 +8005,7 @@ nsDocShell::EndPageLoad(nsIWebProgress* aProgress,
aStatus == NS_ERROR_MALWARE_URI ||
aStatus == NS_ERROR_PHISHING_URI ||
aStatus == NS_ERROR_UNWANTED_URI ||
aStatus == NS_ERROR_HARMFUL_URI ||
aStatus == NS_ERROR_UNSAFE_CONTENT_TYPE ||
aStatus == NS_ERROR_REMOTE_XUL ||
aStatus == NS_ERROR_INTERCEPTION_FAILED ||

3
dom/browser-element/BrowserElementChildPreload.js
View File

@ -1460,6 +1460,9 @@ BrowserElementChild.prototype = {
case Cr.NS_ERROR_MALWARE_URI :
sendAsyncMsg('error', { type: 'malwareBlocked' });
return;
case Cr.NS_ERROR_HARMFUL_URI :
sendAsyncMsg('error', { type: 'harmfulBlocked' });
return;
case Cr.NS_ERROR_UNWANTED_URI :
sendAsyncMsg('error', { type: 'unwantedBlocked' });
return;

1
js/xpconnect/src/xpc.msg
View File

@ -233,3 +233,4 @@ XPC_MSG_DEF(NS_ERROR_PHISHING_URI , "The URI is phishing")
XPC_MSG_DEF(NS_ERROR_TRACKING_URI , "The URI is tracking")
XPC_MSG_DEF(NS_ERROR_UNWANTED_URI , "The URI is unwanted")
XPC_MSG_DEF(NS_ERROR_BLOCKED_URI , "The URI is blocked")
XPC_MSG_DEF(NS_ERROR_HARMFUL_URI , "The URI is harmful")

1
mobile/locales/en-US/overrides/appstrings.properties
View File

@ -31,6 +31,7 @@ externalProtocolUnknown=<Unknown>
externalProtocolChkMsg=Remember my choice for all links of this type.
externalProtocolLaunchBtn=Launch application
malwareBlocked=The site at %S has been reported as an attack site and has been blocked based on your security preferences.
harmfulBlocked=The site at %S has been reported as a potentially harmful site and has been blocked based on your security preferences.
deceptiveBlocked=This web page at %S has been reported as a deceptive site and has been blocked based on your security preferences.
unwantedBlocked=The site at %S has been reported as serving unwanted software and has been blocked based on your security preferences.
cspBlocked=This page has a content security policy that prevents it from being loaded in this way.

6
modules/libpref/init/all.js
View File

@ -5315,7 +5315,7 @@ pref("dom.flyweb.enabled", false);
pref("dom.mapped_arraybuffer.enabled", true);
// The tables used for Safebrowsing phishing and malware checks.
pref("urlclassifier.malwareTable", "goog-malware-shavar,goog-unwanted-shavar,test-malware-simple,test-unwanted-simple");
pref("urlclassifier.malwareTable", "goog-malware-shavar,goog-unwanted-shavar,test-malware-simple,test-unwanted-simple,test-harmful-simple");
#ifdef MOZILLA_OFFICIAL
// In the official build, we are allowed to use google's private
@ -5329,7 +5329,7 @@ pref("urlclassifier.phishTable", "googpub-phish-shavar,test-phish-simple");
pref("urlclassifier.downloadAllowTable", "goog-downloadwhite-proto");
pref("urlclassifier.downloadBlockTable", "goog-badbinurl-proto");
pref("urlclassifier.disallow_completions", "test-malware-simple,test-phish-simple,test-unwanted-simple,test-track-simple,test-trackwhite-simple,test-block-simple,goog-downloadwhite-digest256,base-track-digest256,mozstd-trackwhite-digest256,content-track-digest256,mozplugin-block-digest256,mozplugin2-block-digest256,block-flash-digest256,except-flash-digest256,allow-flashallow-digest256,except-flashallow-digest256,block-flashsubdoc-digest256,except-flashsubdoc-digest256,except-flashinfobar-digest256");
pref("urlclassifier.disallow_completions", "test-malware-simple,test-harmful-simple,test-phish-simple,test-unwanted-simple,test-track-simple,test-trackwhite-simple,test-block-simple,goog-downloadwhite-digest256,base-track-digest256,mozstd-trackwhite-digest256,content-track-digest256,mozplugin-block-digest256,mozplugin2-block-digest256,block-flash-digest256,except-flash-digest256,allow-flashallow-digest256,except-flashallow-digest256,block-flashsubdoc-digest256,except-flashsubdoc-digest256,except-flashinfobar-digest256");
// The table and update/gethash URLs for Safebrowsing phishing and malware
// checks.
@ -5379,7 +5379,7 @@ pref("browser.safebrowsing.provider.google.advisoryName", "Google Safe Browsing.
// Prefs for v4.
pref("browser.safebrowsing.provider.google4.pver", "4");
pref("browser.safebrowsing.provider.google4.lists", "goog-badbinurl-proto,goog-downloadwhite-proto,goog-phish-proto,googpub-phish-proto,goog-malware-proto,goog-unwanted-proto");
pref("browser.safebrowsing.provider.google4.lists", "goog-badbinurl-proto,goog-downloadwhite-proto,goog-phish-proto,googpub-phish-proto,goog-malware-proto,goog-unwanted-proto,goog-harmful-proto");
pref("browser.safebrowsing.provider.google4.updateURL", "https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGLE_API_KEY%&$httpMethod=POST");
pref("browser.safebrowsing.provider.google4.gethashURL", "https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_API_KEY%&$httpMethod=POST");
pref("browser.safebrowsing.provider.google4.reportURL", "https://safebrowsing.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");

1
netwerk/protocol/http/HttpChannelChild.cpp
View File

@ -1153,6 +1153,7 @@ HttpChannelChild::DoOnStopRequest(nsIRequest* aRequest, nsresult aChannelStatus,
aChannelStatus == NS_ERROR_MALWARE_URI ||
aChannelStatus == NS_ERROR_UNWANTED_URI ||
aChannelStatus == NS_ERROR_BLOCKED_URI ||
aChannelStatus == NS_ERROR_HARMFUL_URI ||
aChannelStatus == NS_ERROR_PHISHING_URI) {
nsCString list, provider, prefix;

6
toolkit/components/url-classifier/SafeBrowsing.jsm
View File

@ -401,6 +401,7 @@ this.SafeBrowsing = {
const phishURL = "itisatrap.org/firefox/its-a-trap.html";
const malwareURL = "itisatrap.org/firefox/its-an-attack.html";
const unwantedURL = "itisatrap.org/firefox/unwanted.html";
const harmfulURL = "itisatrap.org/firefox/harmful.html";
const trackerURLs = [
"trackertest.org/",
"itisatracker.org/",
@ -417,6 +418,9 @@ this.SafeBrowsing = {
update += "n:1000\ni:test-unwanted-simple\nad:1\n" +
"a:1:32:" + unwantedURL.length + "\n" +
unwantedURL + "\n";
update += "n:1000\ni:test-harmful-simple\nad:1\n" +
"a:1:32:" + harmfulURL.length + "\n" +
harmfulURL + "\n";
update += "n:1000\ni:test-track-simple\n" +
"ad:" + trackerURLs.length + "\n";
trackerURLs.forEach((trackerURL, i) => {
@ -449,7 +453,7 @@ this.SafeBrowsing = {
};
try {
let tables = "test-malware-simple,test-phish-simple,test-unwanted-simple,test-track-simple,test-trackwhite-simple,test-block-simple";
let tables = "test-malware-simple,test-phish-simple,test-unwanted-simple,test-harmful-simple,test-track-simple,test-trackwhite-simple,test-block-simple";
db.beginUpdate(dummyListener, tables, "");
db.beginStream("", "");
db.updateStream(update);

3
toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
View File

@ -81,6 +81,9 @@ TablesToResponse(const nsACString& tables)
if (FindInReadable(NS_LITERAL_CSTRING("-block-"), tables)) {
return NS_ERROR_BLOCKED_URI;
}
if (FindInReadable(NS_LITERAL_CSTRING("-harmful-"), tables)) {
return NS_ERROR_HARMFUL_URI;
}
return NS_OK;
}

9
toolkit/components/url-classifier/nsUrlClassifierUtils.cpp
View File

@ -227,10 +227,11 @@ static const struct {
const char* mListName;
uint32_t mThreatType;
} THREAT_TYPE_CONV_TABLE[] = {
{ "goog-malware-proto", MALWARE_THREAT}, // 1
{ "googpub-phish-proto", SOCIAL_ENGINEERING_PUBLIC}, // 2
{ "goog-unwanted-proto", UNWANTED_SOFTWARE}, // 3
{ "goog-phish-proto", SOCIAL_ENGINEERING}, // 5
{ "goog-malware-proto", MALWARE_THREAT}, // 1
{ "googpub-phish-proto", SOCIAL_ENGINEERING_PUBLIC}, // 2
{ "goog-unwanted-proto", UNWANTED_SOFTWARE}, // 3
{ "goog-harmful-proto", POTENTIALLY_HARMFUL_APPLICATION}, // 4
{ "goog-phish-proto", SOCIAL_ENGINEERING}, // 5
// For application reputation
{ "goog-badbinurl-proto", MALICIOUS_BINARY}, // 7

1
xpcom/base/ErrorList.py
View File

@ -844,6 +844,7 @@ with modules["URILOADER"]:
errors["NS_ERROR_TRACKING_URI"] = FAILURE(34)
errors["NS_ERROR_UNWANTED_URI"] = FAILURE(35)
errors["NS_ERROR_BLOCKED_URI"] = FAILURE(37)
errors["NS_ERROR_HARMFUL_URI"] = FAILURE(38)
# Used when "Save Link As..." doesn't see the headers quickly enough to
# choose a filename. See nsContextMenu.js.
errors["NS_ERROR_SAVE_LINK_AS_TIMEOUT"] = FAILURE(32)